JP2002368733A - Communication device and its manufacturing method and its computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication device that can build up a stable PKI(Public Key Infrastructure) so as to attain a secure electronic commerce. SOLUTION: The communication device 1 being a component of a communication network is characterized in the provision of a public key of a user of the device and authentication data 4 for authenticating the correctness of the public key.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention particularly relates to a communication device constituting a network, a method of manufacturing the same, and a computer program thereof.

[0002]

2. Description of the Related Art With the rapid spread of the Internet, the Internet has become a natural tool for commerce. However, in electronic commerce, how to secure security is a current issue. In response to such a problem, PKI (Public Key Infrast) using a public key encryption method has been proposed.
structure) is attracting attention.

[0003] At present, in some applications, CA (Certificate Author) is used.
It is distributed and used with a certificate. However, although software is distributed and used with a CA certificate, none of the hardware that operates with the software has a CA certificate, and therefore, in particular, the hardware constitutes a network. In such a case, if specific hardware is maliciously installed in the network, even if a failure occurs, it takes a lot of time and effort to find the cause of the failure, and a stable network environment There was a problem that could not be built.

[0004]

SUMMARY OF THE INVENTION It is an object of the present invention to remedy the above-mentioned disadvantages of the prior art, and in particular, to provide a new communication system which enables the construction of a stable PKI and thereby enables secure electronic commerce. Equipment is provided.

Another object of the present invention is to provide a manufacturing method for manufacturing the above communication device.

[0006]

SUMMARY OF THE INVENTION The present invention basically employs the following technical configuration to achieve the above object.

That is, in a first aspect of the communication device according to the present invention, in a communication device constituting a communication network, the communication device authenticates a public key of a user of the device and the validity of the public key. In a second aspect, in a communication device forming a communication network, the communication device includes at least a public key of the user and a public key of the user. Authentication data that authenticates the validity of the device, information on the user of the device,
In the third aspect, the authentication data for authenticating the validity of the public key is an electronic signature of a certification organization. In a fourth aspect, a predetermined application installed in the communication device, data collected by the application, and the data are encrypted using the public key, Data transfer means for extracting the data from the communication device.

According to another aspect of the method for manufacturing a communication device according to the present invention, a service provider that provides communication means provides a communication device from a device provider that manufactures or provides a communication device used as the communication device. A method of manufacturing a communication device for performing communication using the communication device, wherein the service provider delegates to the device provider an authentication procedure of a public key of the service provider,
A step in which the device provider receives a certificate proving that the public key of the service provider is valid from a certificate issuing authority, and wherein the device provider discloses the service provider in the device. Incorporating a key and a certificate from a certificate issuing authority certifying that the public key of the service provider is valid in the communication device.

According to another aspect of the computer program of the present invention, a service provider that provides communication means receives the provision of the communication device from a device provider that manufactures or provides a communication device to be used as the communication unit. A computer program for manufacturing a communication device for performing communication using a communication device, wherein the device provider receives, from the service provider, a delegation of an authentication procedure of a public key of the service provider. A procedure in which the device provider receives a certificate certifying that the public key of the service provider is valid from a certificate issuing authority; and Incorporating a public key and a certificate from a certificate issuing authority that certifies that the public key of the service provider is valid in the communication device. It is an eye of the computer program.

[0010]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A communication device according to the present invention is a communication device constituting a communication network, wherein the communication device includes a public key of a user of the device and authentication data for authenticating the validity of the public key. Are provided.

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, specific examples of a communication device and a method of manufacturing the same according to the present invention will be described in detail with reference to the drawings.

FIG. 1 is a block diagram of a communication device according to the present invention.

In FIG. 1, reference numeral 1 denotes a communication device for constructing a network according to the present invention, and reference numeral 2 denotes a semiconductor storage device provided in the communication device 1. A service provider (carrier or Internet) is provided in the semiconductor storage device. Servi
ce Provider), a certificate (authentication data) 4 of a certificate issuing authority that certifies that the public key is valid, and other accompanying data 5 are stored.

Reference numeral 6 denotes an application installed in the communication device, and the application 6 has a function of collecting predetermined data. Also, 7
Is a data transfer unit for encrypting the data collected by the application 6 using the public key 3 and extracting the encrypted data to an external device 9.

The public key 3 and the certificate 4 embedded in the device 1 cannot be taken out after shipment, but cannot be falsified at all. If the user tries to take out the certificate, the certificate becomes invalid. I have.

In the communication device 1 configured as described above,
For example, when the application 6 is an application that collects data in the case of an external attack, the data collected by the application 6 is
If the service provider wants to check, application 6
Is encrypted by the transfer means 7 with the public key 3 and transferred to the external device 9. Then, the obtained data is analyzed.

In this case, the data is written using the public key 3
Since the data is encrypted and transmitted, the data can be decrypted only with the private key paired with the public key 3, so that anyone other than the service provider cannot see the collected data, and therefore, is completely secret. Sent.

With this configuration, the service provider can manage many communication devices safely and reliably.

FIG. 2 is a diagram showing the mutual relationship among the above-described service provider, a device provider that manufactures or provides a device, a certificate issuing authority, and a service user.
FIG. 3 is a diagram showing an example of a format of data stored in the communication device 1, and FIG. 4 shows a flow in which the device provider embeds the service provider's public key and certificate in the communication device 1. The process of manufacturing a communication device with a public key and a certificate will be described with reference to these drawings.

First, a service provider 10 that intends to provide a network service such as an Internet connection service creates a key pair (a secret key and a public key), and the secret key is stored under strict control. Holds. The service provider 10 passes the public key, the information of the service provider, and a power of attorney related to the certificate issuance to the device provider 20 acting for the certificate issuance (step S1). The device provider 20 passes the public key, the service provider information, and the power of attorney received from the service provider to the certificate issuing authority 30, and receives a device certificate from the certificate issuing authority 30 (step S2). The device provider 20 embeds and sells the public key and a device certificate for authenticating the validity of the public key in the communication device 1 to be sold to the service provider 10 (step S3).
The public key 3 and the certificate 4 embedded in the communication device 1 cannot be taken out after shipment, but cannot be falsified at all, and countermeasures such as invalidating the certificate if taken out are taken.

As other data stored simultaneously with the public key 3 and the certificate 4, as shown in FIG.
0, and information 52 of the service provider 10. The information 52 of the service provider includes a company name 52a, a use 52b, and other information 53c.
By using c, the device 1 can be used as information for management level identification when managing the device 1.

[0022]

According to the present invention, if a service provider is an ISP as a result of trapping a certificate in a tamper-resistant device, network failure information can be safely and easily grasped. Network management can be more reliable.

In the case of a colocation service or the like, by changing some attributes of the certificate,
From the management service level with the same equipment as
Various services up to the management service level of only performing regular checks without performing constant monitoring can be realized by referencing only certificates.

[0024] Further, by performing network management using certificates, even if a service provider such as an ISP expands the network for its own convenience, it does not depend on an IP address or the like, so a smooth transition can be achieved. It is possible.

Further, since the service provider information upon delivery by the equipment provider describes the company name, use, and the like of the service provider, users who are not intended by the equipment provider,
There is also an effect that the use form can be eliminated.

[Brief description of the drawings]

FIG. 1 is a block diagram of a communication device according to the present invention.

FIG. 2 is a diagram showing a mutual relationship among a service provider, a device provider that manufactures or provides a device, a certificate issuing authority, and a service user.

FIG. 3 is a diagram illustrating an example of a certificate format.

FIG. 4 is a flowchart showing a procedure for embedding a public key and a certificate in a device.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Communication equipment 2 Semiconductor device 3 Public key 4 Certificate 5 Other data 6 Application 7 Data transfer means 10 Service provider 20 Equipment provider 30 Certificate issuing authority 40 Service user

Claims (6)

[Claims] 1. A communication device constituting a communication network, wherein the communication device includes a public key of a user of the device and authentication data for authenticating the validity of the public key. Communication equipment. 2. A communication device constituting a communication network, wherein the communication device includes at least a public key of the user,
A communication device comprising authentication data for authenticating the validity of the public key, information of a user of the device, and information of a manufacturer or a provider of the device. 3. The authentication data for authenticating the validity of a public key is as follows:
The communication device according to claim 1, wherein the communication device is an electronic signature of a certification organization. 4. A communication system further comprising: a predetermined application installed in the communication device; data collected by the application; and data transfer means for encrypting the data using the public key and extracting the data outside the communication device. The communication device according to claim 1, wherein the communication device includes a communication device. 5. A service provider providing communication means,
A method for manufacturing a communication device for receiving the communication device from a device provider that manufactures or provides a communication device used as the communication unit, and performing communication using the communication device. Delegating the service provider's public key authentication procedure to a device provider; and a certificate that certifies from the certificate issuing authority that the service provider's public key is valid. And the device provider communicates, in the device, a public key of the service provider and a certificate from a certificate issuing authority that certifies that the public key of the service provider is valid. A method for manufacturing a communication device, comprising: a step of incorporating the device into a device. 6. A service provider providing communication means,
A computer program for manufacturing a communication device for receiving communication device from a device provider that manufactures or provides a communication device used as the communication unit and performing communication using the communication device. The service provider receives a delegation of the authentication procedure of the public key of the service provider from the service provider, and the device provider notifies the certificate issuing authority that the public key of the service provider is valid. A procedure for receiving a certificate to certify, and a certificate for certifying that the public key of the service provider and the public key of the service provider from the certificate issuing authority are valid in the device. And a computer program for executing the following.